KenyaData Protection Act, 2019, enforcement, penalties and compensation
Data Protection Act, 2019 (No. 24 of 2019), Part VIII (ss. 56-65, 72-74)
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Office of the Data Protection Commissioner to investigate a data subject's complaint and to be able to issue a penalty notice for a contravention of the Act.
- Compensate a data subject who suffers damage from your contravention of the Act.
These lines are LexLint's reading of the law's text. Also read by: Arunda v Office of the Data Protection Commissioner & another; Data Privacy and Governance Society of Kenya (Interested Party) (Constitutional Petition E010 of 2025) [2025] KEHC 12262 (KLR), High Court at Nairobi, judgment of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A general penalty of a fine of up to KES 3,000,000 or imprisonment of up to ten years, or both, applies to a contravention of the Act for which no specific penalty is provided; separate offences include unlawful disclosure of personal data (s. 72) and, in the course of a Data Commissioner investigation, furnishing information known to be false or misleading (s. 57(3)); giving the Data Commissioner false or misleading information in the exercise of the Commissioner's section 9 powers, or obstructing the Commissioner, carries a fine of up to KES 5,000,000 or imprisonment of up to two years, or both (s. 61).
Penalty structure
The Data Commissioner's administrative penalty notice is capped at KES 5,000,000, or, in the case of an undertaking, at whichever is lower of that amount and one per cent of its annual turnover for the preceding financial year (s. 63).
- Rule
- Fixed only
- As of
- Currency
- KES
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
Office of the Data Protection Commissioner (ODPC)
Settledness
- As of
- Case link
- https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/12262/eng@2025-08-12
- Case citation
- Arunda v Office of the Data Protection Commissioner & another; Data Privacy and Governance Society of Kenya (Interested Party) (Constitutional Petition E010 of 2025) [2025] KEHC 12262 (KLR), High Court at Nairobi, judgment of
- Open questions
- Does section 63 of the Data Protection Act, 2019 apply the cap of "one per centum of its annual turnover" to every data controller or data processor, or only to one that is an "undertaking", a term the Act does not define?
What it reaches
Obligation class
Governance
Applicability criteria
- As of
- Combinator
- Any of
- Criteria
- is established or ordinarily resident in Kenya and processes personal data while in Kenya
- not established or ordinarily resident in Kenya, but processing personal data of data subjects located in Kenya
What it makes you log
Who may demand the log
Regulator
Logging duty
Sections 56 to 65 and 72 to 74 cover complaints, investigation, enforcement and penalty notices, appeals, compensation and offences. Section 57 lets the Data Commissioner order any person to produce books, documents and records relevant to a complaint investigation, a power to demand what exists, and no provision requires a controller to create or keep a log. Section 56(3), which has the Commissioner reduce an oral complaint to writing, is the regulator's own record.
- Kind
- None
- As of
What this law does
A data subject may complain to the Data Commissioner, who may issue a penalty notice and, on appeal, be reviewed by the High Court. A person who suffers damage from a contravention of the Act is entitled to compensation from the controller or processor. Unlawful disclosure of personal data and giving false or misleading information to the Data Commissioner are separate criminal offences, and any other contravention with no specific penalty carries a general criminal penalty.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .